Installing Tachyon

The user we're logged in with, 1ETRN\AppInstaller is a local admin on this server and has sysadmin rights in SQL. Both rights are required to install Tachyon.

Note all the different prereqs that are required for Tachyon. In a production environment, different components might already be installed on the server. The Tachyon installer will check for all the prereqs and allow you to install the outstanding ones directly through the installer using PowerShell scripts.

A PowerShell window will open for each prerequisite.

The following three properties, Subject, Serial number and Signature algorithm are not expected to show green checks in the Result column, there will be a warning on Subject alternate name, as we only have one DNS name, we do not have a DMZ server, if the remaining Properties do not show the tick then the certificate was not configured properly. You will need to delete the certificate and re enroll it using the correct properties, or possibly create a new template.

The license is client count sensitive, so Tachyon will not work if you set it to higher than the license count from your license file.

The HTTP Host Header is used internally by Tachyon components; thus, we use the FQDN of the server. The HTTPS Host Header will be used by Tachyon agents and Tachyon users; thus, we use the DNS alias. If you clicked validate, then you can ignore the error message at this time, we will rectify it later.

The HTTPS Host header sets the host header used by the alternate HTTPS binding used by the Tachyon website.

This is mandatory when installing on a DMZ Server, and used for the internal-facing network.

Optionally used by the following if you do not want the the main HTTPS binding, for example if you want to use a different HTTPS port:

• Tachyon clients connecting to the background channel
• Application Migration clients running task sequence and connecting to the SLA Provider API
• AppClarity software reclaimer connecting to the SLA Provider API

Active Directory: LDAP://1etrn.local
SMTP Server: 1ETRNDC.1ETRN.LOCAL
Mail From: Tachyon@1etrn.local
Enable two-factor authentication: Checked

Two-factor authentication prompts users to enter a onetime authorization code in addition to their password to confirm the submission of an action instruction. The code is delivered via email or to a registered mobile device. If this setting is disabled, administrators can execute instructions without the second factor authentication.

We cover AI-based auto-curation in the AppClarity course. And how to enable this post install in Ex 8 - Tachyon v5.2 - Install and Configure - Post installation optional configuration 

Leave the Nomad sync value set to 30, and click on Validate, a message stating no errors were detected should be displayed

In the Certificate to be used by the Background Channel Proxy, click Select and choose the Certificate with the longest Expiry Date,  and select Client Certificate in the type of authentication drop list, and click OK

Click on Validate, a message stating no errors were detected should be displayed, click OK and then click Next

This will display a check of all the components installed and ensure they are configured correctly. If there are any issues the Tachyon Installer will help you resolve them.

The final row of the Post Installation checks is the Product Packs are available option click on the Deploy link.

We could at this stage decide to ignore this but we will invoke the Tachyon Product Pack Deployment Tool to automatically import any product packs and move them into instruction sets (named the same as the .zip file). There is already a folder called ProductPacks in the same location as the Tachyon.Setup.exe (which we have just downloaded and extracted). The ProductPacks folder contains by default the files for the Tachyon Product Pack Deployment Tool and the Classic and Integrated folders with some 1E Product Packs you may want to bulk import into Tachyon. You can also add any additional product pack.zip files you have created or downloaded and wish to import.

We will in later exercises look at uploading Product packs from the Tachyon Exchange.

The Tachyon Product Pack deployment tool will open, the server URL is pre populated with the URL, In the middle section the product packs are listed, all are selected, and in the Results panel the version of the Deployment Tool and the connection status is listed.

Following the step to fix the loopback-check a reboot was prompted to be carried out prior to continuing with the install, restart the server at this point

Tachyon is set up on both HTTP port 80 and HTTPS port 443. HTTP on port 80 is used only internally by different Tachyon components, thus explicit permissions are given only to those applications. This ensures a higher level of security.

These files are used to validate the licensing against a back-end licensing server in the cloud. Note the Tachyon license file(.lic) used to install Tachyon is also present here.

Up to 5 switches can be installed on a single server, and the 1E Tachyon Switch Host service would manage them all. Each switch can manage 50,000 devices for a total of 250,000 devices per server.

The Content folder contains any content, generally in the form of scripts, which are required for instructions. These scripts are embedded into the Instruction XML file but are extracted and placed in this folder to allow agents to download them via the Background Channel using IIS. We will get into Instruction and scripts soon enough.

The Installers folder would contain installers if we are updating the Tachyon agent via Tachyon itself.

The Updates folder is used to update the Tachyon agent through Tachyon itself without having to redeploy an msi.

The Response database holds transient data on a per action basis temporarily, hence it is a very basic database.

You may not see any data here. If you needed to troubleshoot any BI or Cube Data issues you would look in this table for information.

Note the error. This is due to the restrictions that have been set in IIS on the different spaces within the website.

If you are familiar with the prior versions of Tachyon notice the change. We no longer navigate to the Tachyon Explorer via https://tachyon.1etrn.local/Explorer - now we have the Tachyon Portal. The Tachyon Explorer is still here, don't worry!

You will not be able to open any of the other applications as this account has limited access to the platform. Notice that our account cannot even see AppClarity, Explorer, Experience, Inventory, Guaranteed State or Patch Success in the Switch App menu.

By default, the account that Tachyon is installed with has limited rights, one of them being Permissions Administrators, which can create new users and roles. This account cannot change its own permissions, so it is important to use an installer account which you do not want to have any admin rights beyond the basic rights afforded the installer account.

A client certificate is required to authenticate against the Tachyon switch. The certificate has been enrolled on all the other clients, including the servers, ahead of time. If a Windows client certificate already exists on your client devices, no additional certificates will be required.

msiexec /i 1E.Client-x86.msi /l*v 1EClient.log

On the Ready to Install the 1E Client screen, Click Install. On the User Account Control pop-up click OK. When install is completed, click Finish

The Persist folder holds the persistent data for the client. Items such as last instruction processed, or tags reside here. We will review this folder later when we use Tachyon. The DBs folder contains an encrypted database where the Tachyon Activity Record feature stores data from various data sources.

The 1E Client settings are defined in the config file. In a later exercise, we will use Tachyon itself to make changes to these settings.

Close the config file, ensuring no changes were made. If asked to save it, click NO

Navigate to \\1etrnap\Temp and copy the 1EClientDeploymentAssistant.v1.6.0.21 folder to c:\temp

If we were installing PXE Everywhere, NightWatchman, or Web Wakeup the license keys would be populated from our licenses.txt file located in the same folder as the Client Deployment Assistant executable. We are only installing the Tachyon module of the 1E Client for this lab so we do not need a license key as Tachyon is licensed on the server components.

On the Nomad Client Settings page, check the Enable Nomad checkbox, and accept the defaults for Log Path and Log Size. Ensure that only Hidden Nomad Share, Prevent Failing Over to BITS, Delivery Optimization Reporting and P2P Protocol SMB are selected. Click Next

We will be enabling Single Site Download, Fanout and Peer Backup Assistant in the Nomad course.

Our lab is configured to create our applications and packages for only workstation class devices. You can modify this by editing your AppImport.xml in your 1E Client Deployment Assistant folder. We will edit our application to include the servers.

Repeat the client validation steps from above on any of the workstations to ensure the client has installed correctly